CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter

published June 17, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
86%
Percentile
99.7
In the wild
Unconfirmed
What it is

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.85946 · 99.7th percentile
Published
2020-06-17T13:47Z
EPSS history
Timeline
  • 17 JUN 13:47Z
    A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter
    cvelistv5